|
 |
36cfb7 |
From 8ac8129d710b8a084ce213791874330aa30ec70e Mon Sep 17 00:00:00 2001
|
|
|
36cfb7 |
From: Andrea Claudi <aclaudi@redhat.com>
|
|
|
36cfb7 |
Date: Mon, 29 Apr 2019 20:08:08 +0200
|
|
|
36cfb7 |
Subject: [PATCH] tc/m_xt: Fix for potential string buffer overflows
|
|
|
36cfb7 |
|
|
|
36cfb7 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1465646
|
|
|
36cfb7 |
Upstream Status: iproute2.git commit 56270e54661e8
|
|
|
36cfb7 |
|
|
|
36cfb7 |
commit 56270e54661e8ca51d4b3661b9f9bb12a0a40d95
|
|
|
36cfb7 |
Author: Phil Sutter <phil@nwl.cc>
|
|
|
36cfb7 |
Date: Thu Aug 24 11:51:49 2017 +0200
|
|
|
36cfb7 |
|
|
|
36cfb7 |
tc/m_xt: Fix for potential string buffer overflows
|
|
|
36cfb7 |
|
|
|
36cfb7 |
- Use strncpy() when writing to target->t->u.user.name and make sure the
|
|
|
36cfb7 |
final byte remains untouched (xtables_calloc() set it to zero).
|
|
|
36cfb7 |
- 'tname' length sanitization was completely wrong: If it's length
|
|
|
36cfb7 |
exceeded the 16 bytes available in 'k', passing a length value of 16
|
|
|
36cfb7 |
to strncpy() would overwrite the previously NULL'ed 'k[15]'. Also, the
|
|
|
36cfb7 |
sanitization has to happen if 'tname' is exactly 16 bytes long as
|
|
|
36cfb7 |
well.
|
|
|
36cfb7 |
|
|
|
36cfb7 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
36cfb7 |
---
|
|
|
36cfb7 |
tc/m_xt.c | 7 ++++---
|
|
|
36cfb7 |
1 file changed, 4 insertions(+), 3 deletions(-)
|
|
|
36cfb7 |
|
|
|
36cfb7 |
diff --git a/tc/m_xt.c b/tc/m_xt.c
|
|
|
36cfb7 |
index ad52d239caf61..9218b14594403 100644
|
|
|
36cfb7 |
--- a/tc/m_xt.c
|
|
|
36cfb7 |
+++ b/tc/m_xt.c
|
|
|
36cfb7 |
@@ -95,7 +95,8 @@ build_st(struct xtables_target *target, struct xt_entry_target *t)
|
|
|
36cfb7 |
if (t == NULL) {
|
|
|
36cfb7 |
target->t = xtables_calloc(1, size);
|
|
|
36cfb7 |
target->t->u.target_size = size;
|
|
|
36cfb7 |
- strcpy(target->t->u.user.name, target->name);
|
|
|
36cfb7 |
+ strncpy(target->t->u.user.name, target->name,
|
|
|
36cfb7 |
+ sizeof(target->t->u.user.name) - 1);
|
|
|
36cfb7 |
target->t->u.user.revision = target->revision;
|
|
|
36cfb7 |
|
|
|
36cfb7 |
if (target->init != NULL)
|
|
|
36cfb7 |
@@ -277,8 +278,8 @@ static int parse_ipt(struct action_util *a, int *argc_p,
|
|
|
36cfb7 |
}
|
|
|
36cfb7 |
fprintf(stdout, " index %d\n", index);
|
|
|
36cfb7 |
|
|
|
36cfb7 |
- if (strlen(tname) > 16) {
|
|
|
36cfb7 |
- size = 16;
|
|
|
36cfb7 |
+ if (strlen(tname) >= 16) {
|
|
|
36cfb7 |
+ size = 15;
|
|
|
36cfb7 |
k[15] = 0;
|
|
|
36cfb7 |
} else {
|
|
|
36cfb7 |
size = 1 + strlen(tname);
|
|
|
36cfb7 |
--
|
|
|
e138d9 |
2.21.0
|
|
|
36cfb7 |
|